User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.2.2. This makes it possible for unauthenticated attackers to register as administrators when a site administrator has explicitly created a membership role with admin capabilities. This is not something we consider a vulnerability, and was rejected by our team.